Malware 2 - from infection to persistence - Revision history

Eric.freyssinet: Text replacement - "/ www." to "/ |Site=www."

2015-07-31T11:00:59Z

Text replacement - "/ www." to "/ |Site=www."

← Older revision		Revision as of 11:00, 31 July 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Link=http://www.contextis.com/research/blog/malware2/ www.contextis.com		\|Link=http://www.contextis.com/research/blog/malware2/
			\|Site=www.contextis.com
	\|Author=Mark Nicholls		\|Author=Mark Nicholls
	\|NomRevue=Context Blog		\|NomRevue=Context Blog

Eric.freyssinet: 1 revision imported

2015-02-07T14:22:22Z

1 revision imported

← Older revision		Revision as of 14:22, 7 February 2015
(No difference)

Eric.freyssinet at 11:22, 25 November 2012

2012-11-25T11:22:41Z

New page

{{Publication
|Link=http://www.contextis.com/research/blog/malware2/ www.contextis.com
|Author=Mark Nicholls
|NomRevue=Context Blog
|Date=2012-01
|Editor=Context
|Year=2012
|Botnet=Carberp
|Abstract=In my previous posting, a malicious PDF was analysed that originated from a targeted email campaign that exposed a number of users to infection. The PDF file implemented standard exploitation techniques to exploit issues in Adobe PDF reader to download an executable from a known malicious URL (Malware 1 - From Exploit to Infection). In this post I will look at how the malware sample persists on the infected host using stealth, anti-debugging and common userland hooking and rootkit techniques.

The initial analysis of this sample identified that the subsequent download was in fact a dangerous data theft Trojan known as Carberp. This Trojan is primarily associated with financial and data theft and has been compared to the more prevalent ZeuS and SpyEye families. This is due to the similar data exfiltration capabilities of the Carberp family.
|Titre=
}}